CVE-2024-54137

This vulnerability is considered an Important severity rather than Moderate due to its impact on the fundamental security guarantees of the HQC KEM. The mishandling of the secret key, where a sensitive component (sigma) is treated as part of the public key, introduces a structural flaw in the cryptographic implementation. This flaw allows malformed ciphertexts to bypass implicit rejection checks and produce incorrect shared secrets. Such behavior undermines the confidentiality and correctness of the key encapsulation mechanism, potentially enabling adversaries to manipulate cryptographic processes or leak sensitive information. While no concrete exploit has been identified, the theoretical attack surface created by the secret key mismanagement significantly raises the risk level, particularly in security-critical systems or applications relying on HQC for post-quantum resilience.